1961975 - Content-process instantly crashes when opening Print Preview in a debug build, with a black-and-white print target

Status: RESOLVED FIXED

(Core :: SVG, defect)

Description

[Daniel Holbert [:dholbert]]

STR:

1. Start a debug build on macOS, e.g. like so via mozregression: mozregression --launch 2025-04-21 -B debug -a https://example.org
2. In a tab viewing e.g. https://example.org/ (or any site), do Cmd+P to print preview

ACTUAL RESULTS:
Print preview dialog briefly appears, but then the tab changes to show that the content process crashed.

EXPECTED RESULTS:
No such content-process crash.

Regression range:
https://hg-edge.mozilla.org/integration/autoland/pushloghtml?fromchange=bb569ae969013d377e6834c88b8bc9f6e7562eb7&tochange=3ddb53b6a1ce25c0a8c6421ef60a31c2f5a17ded

I'm guessing that there's an assertion failure or something along those lines, given that this seems to be debug-only (based on my testing so far), but the issue isn't obviously shown in my terminal output... Here's the terminal-spam that appears when I print-preview (using mozregression as described in the STR):

 1:07.91 INFO: b'[Parent 90174, Main Thread] WARNING: NS_ENSURE_SUCCESS(rv, rv) failed with result 0x80004005 (NS_ERROR_FAILURE): file /builds/worker/checkouts/gecko/chrome/nsChromeRegistry.cpp:182'
 1:07.91 INFO: b"[Parent 90174, Main Thread] WARNING: 'NS_FAILED(rv)', file /builds/worker/checkouts/gecko/chrome/nsChromeProtocolHandler.cpp:73"
 1:07.98 INFO: b'[Parent 90174, Main Thread] WARNING: Failed to retarget HTML data delivery to the parser thread.: file /builds/worker/checkouts/gecko/parser/html/nsHtml5StreamParser.cpp:1215'
 1:08.37 INFO: b'[Parent 90174, Main Thread] WARNING: Caller should supply a printer name.: file /builds/worker/checkouts/gecko/widget/nsPrintSettingsService.cpp:921'
 1:08.40 INFO: b'[Child 91741, Main Thread] WARNING: Caller should supply a printer name.: file /builds/worker/checkouts/gecko/widget/nsPrintSettingsService.cpp:921'
 1:09.01 INFO: b"[Parent 90174, IPC I/O Parent] WARNING: [1.1]: Dropping message '<null>'; no connection to unknown peer 24415CD991C33CCC.D655D4B50D5D3962: file /builds/worker/checkouts/gecko/ipc/glue/NodeController.cpp:364"
 1:09.02 INFO: b"[Parent 90174, Main Thread] WARNING: IPC message 'PBrowser::Msg_Destroy' discarded: actor cannot send: file /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp:545"
 1:09.02 INFO: b'[Parent 90174, Main Thread] WARNING: No build ID mismatch: file /builds/worker/checkouts/gecko/dom/base/nsFrameLoader.cpp:3742'
 1:09.02 INFO: b'JavaScript error: resource:///modules/ContentCrashHandlers.sys.mjs, line 289: TypeError: can\'t access property "getTabForBrowser", gBrowser is null'
 1:09.02 INFO: b"[Parent 90174, ProcessHangMon] WARNING: IPC message 'PProcessHangMonitor::Msg_RequestContentJSInterrupt' discarded: actor cannot send: file /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp:545"
 1:09.02 INFO: b"[Parent 90174, Main Thread] WARNING: IPC message 'PBrowser::Msg_Destroy' discarded: actor cannot send: file /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp:545"
 1:09.02 INFO: b'[Parent 90174, Main Thread] WARNING: No build ID mismatch: file /builds/worker/checkouts/gecko/dom/base/nsFrameLoader.cpp:3742'
 1:09.04 INFO: b"[Parent 90174, Main Thread] WARNING: IPC message 'PContent::Msg_GetLayoutHistoryState' discarded: actor cannot send: file /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp:545"
 1:09.04 INFO: b"[Parent 90174, Main Thread] WARNING: IPC message 'PContent::Msg_CommitBrowsingContextTransaction' discarded: actor cannot send: file /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp:545"
 1:09.04 INFO: b"[Parent 90174, Main Thread] WARNING: IPC message 'PContent::Msg_DiscardBrowsingContext' discarded: actor cannot send: file /builds/worker/checkouts/gecko/ipc/glue/ProtocolUtils.cpp:545"
 1:09.14 INFO: b'[Parent 90174, IPC I/O Parent] WARNING: process 91741 exited with status 1: file /builds/worker/checkouts/gecko/ipc/chromium/src/chrome/common/process_watcher_posix_sigchld.cc:126'

Comment 1

[BugBot [:suhaib / :marco]]

Set release status flags based on info from the regressing bug 1957689

:emilio, since you are the author of the regressor, bug 1957689, could you take a look? Also, could you set the severity field?

For more information, please visit BugBot documentation.

Comment 2

[Daniel Holbert [:dholbert]]

ok, I caught this in a debugger. Not sure why this isn't resulting in a stack in my terminal (maybe my mac needs some config for that to work properly), but in any case here's the backtrace from lldb:

  * frame #0: 0x000000014ada601f XUL`nsINode::GetBoolFlag(this=0x0000000000000000, name=NodeIsElement) const at nsINode.h:2089:12
    frame #1: 0x000000014b1ca2ea XUL`nsINode::IsElement(this=0x0000000000000000) const at nsINode.h:575:35
    frame #2: 0x000000014b1c806d XUL`nsINode::AsElement(this=0x0000000000000000) at Element.h:2371:3
    frame #3: 0x00000001545e5f0f XUL`mozilla::SVGFilterObserverListForCSSProp::SVGFilterObserverListForCSSProp(this=0x000000010d7da480, aFilters=Span<const mozilla::StyleGenericFilter<mozilla::StyleAngle, float, float, mozilla::StyleCSSPixelLength, mozilla::StyleGenericSimpleShadow<mozilla::StyleGenericColor<mozilla::StylePercentage>, mozilla::StyleCSSPixelLength, mozilla::StyleCSSPixelLength>, mozilla::StyleComputedUrl>, 18446744073709551615UL> @ 0x00007ff7bc6fcf98, aFilteredFrame=0x000000010d6ecb90) at SVGObserverUtils.cpp:938:61
    frame #4: 0x00000001545e5e7d XUL`mozilla::SVGFilterObserverListForCSSProp::SVGFilterObserverListForCSSProp(this=0x000000010d7da480, aFilters=Span<const mozilla::StyleGenericFilter<mozilla::StyleAngle, float, float, mozilla::StyleCSSPixelLength, mozilla::StyleGenericSimpleShadow<mozilla::StyleGenericColor<mozilla::StylePercentage>, mozilla::StyleCSSPixelLength, mozilla::StyleCSSPixelLength>, mozilla::StyleComputedUrl>, 18446744073709551615UL> @ 0x00007ff7bc6fcfd0, aFilteredFrame=0x000000010d6ecb90) at SVGObserverUtils.cpp:939:47
    frame #5: 0x00000001545e5dfa XUL`mozilla::SVGFilterObserverListForCSSProp* mozilla::GetOrCreateFilterObserverListForCSS<mozilla::SVGFilterObserverListForCSSProp>(aFrame=0x000000010d6ecb90, aHasFilters=true, aProperty=0x000000015fe76b50, aFilters=Span<const mozilla::StyleGenericFilter<mozilla::StyleAngle, float, float, mozilla::StyleCSSPixelLength, mozilla::StyleGenericSimpleShadow<mozilla::StyleGenericColor<mozilla::StylePercentage>, mozilla::StyleCSSPixelLength, mozilla::StyleCSSPixelLength>, mozilla::StyleComputedUrl>, 18446744073709551615UL> @ 0x00007ff7bc6fd048) at SVGObserverUtils.cpp:1362:19
    frame #6: 0x00000001545c6636 XUL`mozilla::GetOrCreateFilterObserverListForCSS(aFrame=0x000000010d6ecb90, aStyleFilterType=Filter) at SVGObserverUtils.cpp:1378:16
    frame #7: 0x00000001545c7916 XUL`mozilla::SVGObserverUtils::InitiateResourceDocLoads(aFrame=0x000000010d6ecb90) at SVGObserverUtils.cpp:1637:13
    frame #8: 0x00000001543c59f2 XUL`nsIFrame::DidSetComputedStyle(this=0x000000010d6ecb90, aOldComputedStyle=0x0000000000000000) at nsIFrame.cpp:1378:5
    frame #9: 0x000000015438739f XUL`nsIFrame::Init(this=0x000000010d6ecb90, aContent=0x0000000000000000, aParent=0x000000010d6ecab8, aPrevInFlow=0x0000000000000000) at nsIFrame.cpp:755:3
    frame #10: 0x000000015449f26a XUL`nsSplittableFrame::Init(this=0x000000010d6ecb90, aContent=0x0000000000000000, aParent=0x000000010d6ecab8, aPrevInFlow=0x0000000000000000) at nsSplittableFrame.cpp:30:13
    frame #11: 0x0000000154339f41 XUL`nsContainerFrame::Init(this=0x000000010d6ecb90, aContent=0x0000000000000000, aParent=0x000000010d6ecab8, aPrevInFlow=0x0000000000000000) at nsContainerFrame.cpp:66:22
    frame #12: 0x00000001541ab7d9 XUL`nsCSSFrameConstructor::ConstructPageFrame(this=0x000000010470cda0, aPresShell=0x000000010d7bd000, aParentFrame=0x000000010d6ecab8, aPrevPageFrame=0x0000000000000000, aCanvasFrame=0x00007ff7bc6fd5e0) at nsCSSFrameConstructor.cpp:2935:14
[...]
    frame #21: 0x0000000154754673 XUL`nsPrintJob::DoCommonPrint(this=0x000000010d696c80, aIsPrintPreview=true,
[...]
    frame #26: 0x0000000152c9bc2d XUL`mozilla::dom::BrowserChild::RecvPrintPreview(this=0x0000000105579000, aPrintData=0x00007ff7bc701ab8, aSourceBC=0x00007ff7bc6ffc80, aCallback=0x00007ff7bc703820) at BrowserChild.cpp:2618:17

The issue is that we get here:

   935 	  SVGFilterObserverListForCSSProp(Span<const StyleFilter> aFilters,
   936 	                                  nsIFrame* aFilteredFrame)
   937 	      : SVGFilterObserverList(aFilters,
-> 938 	                              aFilteredFrame->GetContent()->AsElement(),

And it turns out that aFilteredFrame->GetContent() is nullptr, so we're calling AsElement() on a null pointer. And that ends up segfaulting in AsElement()'s call to MOZ_ASSERT(IsElement());, because IsElement tries to read data off of the this object.

Comment 3

[Daniel Holbert [:dholbert]]

Searchfox link for the code that I quoted in previous comment:
https://searchfox.org/mozilla-central/rev/29184ec2b107c8b9dd8c9a594711c27545dfb2c7/layout/svg/SVGObserverUtils.cpp#938

The AsElement() call there was indeed added in a patch for bug 1957689, so it makes sense that bug 1957689 is the regressor here.

Probably we just want to do a null-check there.

Comment 4

[Daniel Holbert [:dholbert]]

aFilteredFrame is the nsPageFrame here, which does indeed have an explicitly null mContent pointer, passed as the first arg here:
https://searchfox.org/mozilla-central/rev/29184ec2b107c8b9dd8c9a594711c27545dfb2c7/layout/base/nsCSSFrameConstructor.cpp#2935

pageFrame->Init(nullptr, aParentFrame, aPrevPageFrame);

The filter in question is the grayscale filter that we show for "Black and white" printers. And this isn't mac-specific, but I was just specifically-able-to-repro-it-on-my-mac because my mac's default printer happens to be black-and-white. I can repro on Linux as well if I perform the STR and choose a black-and-white printer.

Comment 5

[Daniel Holbert [:dholbert]]

Attachment: Bug 1961975: Gracefully handle nsIFrame::GetContent() being null in SVGObserverUtils.cpp. r?emilio

nsPageFrame is one example of a frame with a null mContent pointer that can
have a CSS filter applied (making it hit the SVGFilterObserverListForCSSProp
code in this patch). So we need to allow for the possibility that mContent
could be nullptr.

Comment 6

[Daniel Holbert [:dholbert]]

Note we have a handful of other mContent->AsElement() & GetContent()->AsElement() calls in layout/svg:
https://searchfox.org/mozilla-central/search?q=AsElement%28%29&path=layout%2Fsvg&case=false&regexp=false

I considered whether we need this same sort of graceful fallback for those, but at first glance, I think all of the other ones (outside of SVGObserverUtils.cpp) are getting 'this->mContent` from some SVG frame -- and it's safe to assume that an SVG frame's mContent is non-null since SVG frames must necessarily come from SVG elements (rather than being e.g. generated as an anonymous outer wrapper for a document like nsPageFrame is).

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/262a299aebc5
Gracefully handle nsIFrame::GetContent() being null in SVGObserverUtils.cpp. r=emilio

Comment 8

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/262a299aebc5